Serverpod改进存储密码哈希的安全性·CVE-2024-29886·GitHub安全公告数据库

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

import 'dart:io';

import 'package:serverpod/serverpod.dart';
import 'package:serverpod_auth_server/module.dart' as auth;

class MigratePasswordsRoute extends Route {
  @override
  Future<bool> handleCall(Session session, HttpRequest request) async {
    request.response.writeln(
      'Migrating legacy passwords, check the server logs for progress updates.',
    );
    _migratePasswords(session);
    return true;
  }
}

Future<void> _migratePasswords(Session session) async {
  session.log('Starting to migrate passwords.');

  var totalMigratedPasswords = 0;
  while (true) {
    try {
      var entriesMigrated = await auth.Emails.migrateLegacyPasswordHashes(
        session,
        // 每次处理100个数据库条目
        batchSize: 100,
        // 在迁移500个条目后停止
        maxMigratedEntries: 500,
      );

      totalMigratedPasswords += entriesMigrated;
      session.log(
        'Migrated $entriesMigrated password entries, total $totalMigratedPasswords.',
      );

      if (entriesMigrated == 0) break;

      // 延迟以避免数据库过载
      await Future.delayed(Duration(seconds: 1));
    } catch (e) {
      session.log('Error migrating passwords: $e');
    }
  }

  session.log('Finished migrating passwords.');
}